IDIS Product Security

Transcription

1 (Mar ) 2014 IDIS Co., Ltd. All rights reserved. IDIS and identifying product names and numbers herein are registered trademarks of IDIS Co., Ltd. All non-idis brands and product names are trademarks of their respective companies. Product appearance, build status and/or specifications are subject to change without notice.

2 Table of Contents 1 Secure Data Recording Chained finger print Secure Data Communication on Network Closed Network SSL (Secured Socket Layer) Encrypted Data Password Encryption Secure Data Communication on FEN (For Every Network) Service Secure Device Information and Configuration Authentication and Access Control Pairing Operation between Two Devices (DirectIP devices) IEEE802.1x Authentication (Non-DirectIP camera) IP Filtering Connection Timeout Convenient Client Connection Version History

3 1 Secure Data Recording 1.1 Chained finger print IDIS invented its own Chained Finger Print encryption scheme. Basically, a special code is given to each frame from the key frame. These consecutive codes are linked to each other so that it can be used to detect any alterations. The code will break if there is any alteration on the video data. 2 Secure Data Communication on Network 2.1 Closed Network Closed network topology provides the best performance and higher network security. IDIS network solutions including DirectIPTM support both closed and open network topology. User can install the surveillance devices as a closed network for transmitting data with stable frame rate and lover delays as well as minimizing data access by unauthorized user. 2.2 SSL (Secured Socket Layer) Encrypted Data By applying the SSL encryption, it is possible to prevent data sniffing, destructions, modifications and any other illegal acts in data transmission on the network. Regards to the SSL encryption, user can select the several SSL encryption levels as the following: Header only: the header of data packets are encrypted only. Exclude Multimedia: the data packets except multimedia data are encrypted. Partially Multimedia: the data packets including partial multimedia data are encrypted. Full Multimedia: all data packets are encrypted. 2.3 Password Encryption The password for registered users and devices are encrypted by popular hash algorithm such as SHA-256 to prevent unauthorized user from accessing the devices. 2.4 Secure Data Communication on FEN (For Every Network) Service FEN service is an automated network configuration service which simplifies installation of networked surveillance system. FEN enables the user to setup and configure surveillance systems without having professional knowledge of routers or NAT devices on the network. FEN service supports the secure data communication among the devices or multiple FEN services to prevent unauthorized user from accessing IDIS network device on public network environment. SSL encryption based on TCP is used for data communication between devices via Proxy service even though UDP hole punching or Relay service is used. RSA key is used for secure data communication from each other. 3 Secure Device Information and Configuration NVRs and cameras have binary file which contains the user and device information and configurations. To obtain valid information from the file, IDIS registry viewer must be used. In addition, information needs higher security levels such as the passwords for user and devices are encrypted in binary file. 3

4 IDIS VMS software uses the data encryption enabled database to ensure user and device information and configurations are managed safely. 4 Authentication and Access Control 4.1 Pairing Operation between Two Devices (DirectIP devices) DirectIP camera stores connected DirectIP NVR s MAC address as well as the registration and connection information flag. Another DirectIP NVR or other devices cannot connect to the DirectIP camera that is already connected to a DirectIP NVR. 4.2 IEEE802.1x Authentication (Non-DirectIP camera) IDIS cameras support IEEE802.1x-compliant software and can be operated as an authorized supplicant in IEEE802.1 network. 4.3 IP Filtering IDIS VMS and cameras support IP filtering function which prevents access to IDIS VMS, NVRs and IP cameras from unauthorized IP device. 4.4 Connection Timeout IDIS VMS allows the administrator to set valid connection time for each registered user. This prevents a specific user from holding device resources and network bandwidth for a long time. 4.5 Convenient Client Connection IDIS client software automatically detects if connected device or server supports the SSL data communication. So, users do not need to worry about the secure connection such as HTTPS. 4

5 5 Version History Version Writer Revision Date Remarks 1.00 Daniel Lee Jan Initial Release 1.01 Daniel Lee Jan IEEE802.1x Authentication expression was modified 1.02 Daniel Lee Mar Document title is changed from IDIS Security Technology to IDIS Product Security 5